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through a Labehng Attack 
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I present an eavesdropping on the protocol proposed by W.-H. Kye, et al. [Phys. Rev. Lett. 95, 
040501 (2005)]. I show how an undetectable Eve can steal the whole information by labeling and 
then measuring the photons prepared by the user Alice. 

PACS numbers: 03.67.Dd, 03.67.Hk 
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In Ref. it is described a novel three-way protocol 
for quantum key distribution, defined "blind" because 
it does not require the public revelation of the polar- 
ization bases; let me call it for ease KKKP, after the 
names of its inventors. One nice feature of KKKP is 
that the "control mode" present in Ping-Pong-like pro- 
tocols is not necessary, because of the randomness of the 
traveling photons polarization. Unfortunately this same 
feature makes KKKP vulnerable to a number of attacks 
by an eavesdropper (Eve) whose aim is to steal infor- 
mation from Alice and Bob. As a consequence KKKP 
experienced a series of modifications '5, 's'l in order 
to improve its security without changing the philosophy 
of the scheme: the Impersonation attack Q is avoided 
through the preparation of two pulses on Alice side fol- 
lowed, at a proper time, by a random blocking of one of 
the two, and through the addition of a random parameter 
on Bob side, the 'shuffling factor' s 0. Notwithstanding, 
these changes alone are not sufficient to avert the attack, 
as noticed in 'F] , and it was necessary to double the shuf- 
fling parameter in two, the shufflings si and S2 1^- Fi- 
nally, an eavesdropping resulting from the combination 
of Invisible-photon attack ^ and the PNS attack |^ can 
be avoided through a random check of the intensities of 
the beams by Alice and/or Bob 

In this Comment I show that despite the above mod- 
ifications KKKP can still be attacked successfully with- 
out risk of detection. The main tool at Eve's disposal is 
what I call a "labeling-and-measure" strategy. It can be 
thought as a small shift of one of the involved photons' 
degree of freedom, like the wavelength for instance, in a 
way similar to what proposed by Cai in 0. This makes 
the photons distinguishable to Eve, who can thus mea- 
sure the relevant parameters of the communication. 

In the three-way KKKP Alice prepares a photon in 
a polarization state — cos0|O) — sin(?|l), choosing 
randomly the angle 9. Bob rotates the polarization of 
the received photon by applying the unitary operator 
Uy {(j)) — cos (j)I — i sin (pay , with (j) randomly chosen as 
well; then returns the photon to Alice. Alice applies the 
transformation Uy{—6 + {—\)^ '^/^) to the photon, where 
k = 0, 1, thus removing the protection 9 from the state, 
and encoding on it the key 'fc'. In this way Bob, af- 
ter compensating for his angle 0, can deterministically 
infer the key. In the stronger version of KKKP Alice 
sends two photons to Bob, with independent angles 9i 



and 02- Bob executes Uy{(j)+ (—1)*^ '''/4) on the first and 
Uy{(j) + (—1)"^ T^/^:) on the second, and returns them to 
Alice. Alice adds the key as before, but she also blocks 
one of the two pulses according to the value or 1 of the 
'blocking factor' b. Then, after removing any temporal 
label from the resulting photon, she forwards it to Bob, 
who measures it as before. Afterward, Alice's public dis- 
closure of b allows Bob to reconstruct the key. To this 
stronger version of KKKP I add also the random con- 
trol on the intensity of the beams during the protocol, 
by Alice and/or Bob, and call this final version KKKP . 

Now I describe the label-and-measure eavesdropping 
on KKKP . For explicative purposes the label I use is the 
wavelength of the photons. However any other degree of 
freedom different from the polarization (e.g. the momen- 
tum direction, an eventual phase respect to a reference 
signal, the temporal distribution, etc.) can be used as a 
label by Eve, and constitutes a loophole of the protocol. 

Let us suppose, like in the Impersonation attack, that 
there are Evel, who impersonates Bob to Alice, and 
Eve2, who impersonates Alice to Bob. The hard work 
is made by Evel, who steals both the key k and the 
block factor b from Alice. In KKKP Alice sends out the 
pulses 9i and 9-2 at a certain wavelength A. Evel chooses 
randomly one of the two photons, say the first one (pi), 
and shifts its wavelength into Xi = X + 5, while leav- 
ing the second (p2) unchanged. i5 is a quantity different 
from zero whose smallness depends on Evel's technology, 
which one must assume to be infinite, or at least greater 
than Alice and Bob's one. According to the protocol, Al- 
ice performs the operations Uy{—9i + ( — l)'^7r/4) on pi 
and Uy{-92 + (-1) 7r/4) on p2. Then she blocks one of 
the two photons, say p2, and forwards pi, after delaying 
it properly to make it undistinguishable in time from p2. 
It is straightforward to see that from Alice side exits only 
p\ in the state: 



10- (-l)'=7r/4,Ai) . 



(1) 



where the wavelength is indicated together with the po- 
larization state. Note that the protection 9i has been 
removed from pi by Alice through her last transforma- 
tions. By measuring the wavelength and the polarization 
of the photon in the state Evel can infer which pulse 
was blocked, i.e. the blocking factor 6, and the value of 
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k. These two values are accordingly used by Eve2 on a 
pair of fake pulses sent to Bob, in order to mimic to him 
the presence of Alice. Since the imitation is perfect Bob 
has no chance to unveil the attack. Let me point out that 
although I described the eavesdropping as two separate 
temporal sequences it is on the contrary important that 
Evel and Eve2 act in synchronization in the following 
way: 

1. Evel modifies pi and stores pi and p2 

2. Eve2 sends a pair of fake pulses to Bob 

3. when Eve2 receives back the two fake pulses from Bob 
Evel forwards to Alice the two photons she stored 

4. ...and so on. 

This makes the usage of public receipts of the photons by 
Alice and Bob ineffective against Eve. Finally, a control 
of the intensity of the beams is clearly useless in this case 
since the intensity is not altered by Eve. 

In conclusion I showed an explicit label-and-measure 
eavesdropping against the stronger version of the KKKP 



protocol 'l*!, illustrated by a simple wavelength shift of 
one of the photons prepared by Alice. This attack pro- 
vides Eve with a complete knowledge of the exchanged 
information, without the possibility by Alice and Bob of 
detect her presence. The insertion of (wavelength) fil- 
ters in analogy with what proposed in ^ does not work 
in this case because there is no polarization detections 
during the protocol. Nevertheless, the introduction of 
polarization controls along the channels of KKKP is not 
simple, just because of the randomness of the polariza- 
tion bases. 

The solution of the problem should include the Alice 
removal of all potential Eve's labels. Perhaps Alice could 
use the teleportation process to transfer the polarization 
state of the unblocked photon on another photon whose 
degrees of freedom are not controlled by Eve. Despite its 
practical difficulty this solution seems to be not outside 
the range of current technology. 
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